/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

15 votes135 views2 answers
Git see stash
Shell/Bash
7 votes131 views2 answers
Install PIP ArchLinux
Shell/Bash
4 votes165 views3 answers
Git push username password
Shell/Bash
69 votes138 views6 answers
Install yarn
Shell/Bash
2 votes132 views2 answers
Git get commit author
Shell/Bash
0 vote125 views1 answer
Using environment variables in github actions
Shell/Bash
10 votes126 views4 answers
Git revert one file
Shell/Bash
3 votes154 views1 answer
Notepad++ kali
Shell/Bash
1 vote150 views1 answer
Use vscode as default file editor for filezilla ubuntu
Shell/Bash
11 votes135 views1 answer
Uninstall node js and npm ubuntu
Shell/Bash